Issues · github/codeql · GitHub

Labels Milestones New issue

False negative: py/sql-injection missing a sqlite3/PEP249 pattern

#21769

· invoke1442 opened

on Apr 29, 2026

False negative: missing os.exec* APIs with `sh -c` as sink in py/code-injection.

#21735

· 9iang22 opened

on Apr 19, 2026

GHAS-managed workflows reference mutable action versions, incompatible with required SHA-pinning policies

#21732

· kyleburnsdev opened

on Apr 17, 2026

[question?] counterintuitive class method behaviour

#21670

· k4lizen opened

on Apr 8, 2026

Can the location of the disk cache be customised, and does CodeQL gracefully handle missing cache?

#21663

· gsutherland-trailofbits opened

on Apr 7, 2026

actions/unpinned-tag does not flag unpinned reusable workflow calls (job-level uses:)

#21659

· PhilipAtCisco opened

on Apr 6, 2026

Support for `.razor` files is unclear

#21645

· Frulfump opened

on Apr 3, 2026

C++: Model taint flow through pointer-returning methods using MaD summaries

#21623

· hello123leo opened

on Mar 31, 2026

Accuracy improvements for py/clear-text-logging-sensitive-data

#21595

· sarr424 opened

on Mar 27, 2026

Are the Actions model files in ext/manual and ext/generated actively used and maintained?

#21570

· XinyuZhangXvX opened

on Mar 24, 2026

Azure DevOps Ubuntu 24.04 DB Creation for C#

#21562

· Tingle01 opened

on Mar 24, 2026

False Negative: CloseWriter.ql misses leaked wrapped streams when the close is skipped by an early return or hidden in a factory.

#21534

· Carlson-JLQ opened

on Mar 22, 2026